search

samtap / fang-hacks

Collection of modifications for the XiaoFang WiFi Camera
1.67k stars 341 forks source link

Password protect the HTTP interface #221

Open nmaster2042 opened 7 years ago

nmaster2042 commented 7 years ago

Hi,

I have successfully hacked 2 cams, very cool stuff you made, thanks.

Is there a way to password protect the http://DEVICE_IP/cgi-bin/status url to prevent everyone to make change other than the admin ?

samtap commented 7 years ago

Not yet but I'm planning to switch to busybox httpd instead of boa, to support auth.

BlaY0 commented 7 years ago

You could make use of uhttpd which is used mainly by OpenWRT. You can download already precompiled binaries (Kirkwood) from OpenWRT site. The only drawback at this point is that you would need to use matching uClibc because one used by SONiX is lacking some functionality.

samtap commented 7 years ago

httpd works find and is already available (from busybox). I would look into something else if it provides auth, ssl and cgi support. Httpd does auth and cgi but I still need stunnel for ssl.

BlaY0 commented 7 years ago

That's exactly what uhttpd supports:

https://wiki.openwrt.org/doc/howto/http.uhttpd

...besides that it supports Lua, which is a scripting language meant especially for configuring embedded devices.

samtap commented 7 years ago

I'd like to keep all scripts compatible with boa so you could also use it without sd-card (losing auth and ssl support). But I'll have a look at uhttpd and see if it builds agains snx libc and openssl (libustream may be a problem).

mvillarejo commented 7 years ago

It'll be great to have this feature implemented. +1